{"id":347051,"date":"2026-08-01T17:57:18","date_gmt":"2026-08-01T17:57:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/active-directory-multi-domain-auth-acl\/"},"modified":"2026-08-13T14:20:17","modified_gmt":"2026-08-13T14:20:17","slug":"sanch-multidomain-ldap-auth","status":"publish","type":"plugin","link":"https:\/\/mlt.wordpress.org\/plugins\/sanch-multidomain-ldap-auth\/","author":23539842,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.1.1","stable_tag":"1.1.1","tested":"7.1","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Sanch MultiDomain LDAP Auth for Active Directory","header_author":"sanchshevchuk","header_description":"Enterprise AD Integration: Zero-Trust ACL, Smart Tree Routing, Loop\/Search Leak Protection, LDAP Clone Guard, and Role Cap Merge.","assets_banners_color":"","last_updated":"2026-08-13 14:20:17","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":147,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"sanchshevchuk","date":"2026-08-01 17:57:08"},"1.0.1":{"tag":"1.0.1","author":"sanchshevchuk","date":"2026-08-13 11:29:50"},"1.0.2":{"tag":"1.0.2","author":"sanchshevchuk","date":"2026-08-13 12:24:07"},"1.0.3":{"tag":"1.0.3","author":"sanchshevchuk","date":"2026-08-13 12:36:49"},"1.0.6":{"tag":"1.0.6","author":"sanchshevchuk","date":"2026-08-13 13:12:10"},"1.0.7":{"tag":"1.0.7","author":"sanchshevchuk","date":"2026-08-13 13:47:33"},"1.1.0":{"tag":"1.1.0","author":"sanchshevchuk","date":"2026-08-13 14:10:52"},"1.1.1":{"tag":"1.1.1","author":"sanchshevchuk","date":"2026-08-13 14:20:17"}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.6","1.0.7","1.1.0","1.1.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[14437,2463,710,2464,10643],"plugin_category":[38],"plugin_contributors":[274183],"plugin_business_model":[],"class_list":["post-347051","plugin","type-plugin","status-publish","hentry","plugin_tags-acl","plugin_tags-active-directory","plugin_tags-authentication","plugin_tags-ldap","plugin_tags-multi-domain","plugin_category-authentication","plugin_contributors-sanchshevchuk","plugin_committers-sanchshevchuk"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/sanch-multidomain-ldap-auth.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Sanch MultiDomain LDAP Auth for Active Directory provides enterprise-grade Single Sign-On (SSO) and access control for corporate WordPress intranets. Built for multi-forest environments, it allows users to authenticate seamlessly against multiple Domain Controllers while strictly enforcing path-based access policies and dynamic role propagation.<\/p>\n\n<h4>Key Features<\/h4>\n\n<ul>\n<li><strong>Multi-Domain &amp; Multi-DC Authentication:<\/strong> Connect and authenticate against multiple LDAP\/LDAPS servers across different Active Directory domains\/UPN suffixes.<\/li>\n<li><strong>Zero-Trust Path-Based ACL:<\/strong> Restrict intranet sections, categories, and custom routes based on AD Group Membership (CN) or mapped WP Roles.<\/li>\n<li><strong>JIT Provisioning &amp; Single Source of Truth:<\/strong> Automatic user creation on first successful AD bind, with optional strict role sync on every login.<\/li>\n<li><strong>LDAP Clone Protection:<\/strong> Detects and prevents authentication if multiple accounts match the same SAMAccountName across refined Base DNs to block privilege escalation.<\/li>\n<li><strong>REST API &amp; Write ACL Protection:<\/strong> Enforces URL routing policies over REST API endpoints and post\/page editing privileges (<code>map_meta_cap<\/code>).<\/li>\n<li><strong>Secure Connections:<\/strong> Supports LDAP (Plaintext), LDAP + StartTLS, and LDAPS (SSL\/TLS Encrypted).<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>sanch-multidomain-ldap-auth<\/code> directory to the <code>\/wp-content\/plugins\/<\/code> directory.<\/li>\n<li>Activate the plugin through the 'Plugins' menu in WordPress.<\/li>\n<li>Ensure the PHP LDAP extension (<code>php-ldap<\/code>) is installed and enabled on your web server.<\/li>\n<li>Navigate to <strong>Settings -&gt; AD Auth Settings<\/strong> in your WordPress admin dashboard.<\/li>\n<li>Configure your Domain Controllers (IP, Port, Domain, Base DN) and define your AD Group to WP Role mapping rules.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20require%20the%20php%20ldap%20extension%3F\"><h3>Does this plugin require the PHP LDAP extension?<\/h3><\/dt>\n<dd><p>Yes, your web server must have the <code>php-ldap<\/code> PHP module enabled to initiate connections with your Active Directory Domain Controllers.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20an%20ad%20user%20does%20not%20belong%20to%20any%20mapped%20group%3F\"><h3>What happens if an AD user does not belong to any mapped group?<\/h3><\/dt>\n<dd><p>By default under Zero-Trust policy, authentication will fail with an \"Access Denied\" message if the user does not belong to at least one mapped AD Group.<\/p><\/dd>\n<dt id=\"how%20are%20custom%20wp%20roles%20handled%3F\"><h3>How are custom WP roles handled?<\/h3><\/dt>\n<dd><p>You can select existing WordPress roles or create custom role slugs directly from the settings page, assigning base capability sets (<code>subscriber<\/code>, <code>editor<\/code>, <code>author<\/code>, <code>administrator<\/code>).<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>Security: Fixed an Indirect Data Leak vulnerability in the get_pages filter. Restricted parent IDs are now fully re-parented exclusively against the pre-filtered allowed pages matrix, eliminating the risk of themes fetching restricted parent titles via direct get_post($post_parent) calls.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Feature: Added Universal REST API Safe Reparenting hook. Solves the issue where modern Block Themes (FSE) and Gutenberg navigation blocks would hide valid child pages if their parent was restricted by Zero-Trust ACLs. Child pages are now smoothly promoted to the root level on the frontend menu without compromising backend structures.<\/li>\n<\/ul>\n\n<h4>1.0.9<\/h4>\n\n<ul>\n<li>Bugfix: Implemented robust fallback logic to automatically clear corrupted or outdated transients containing legacy flat arrays, fixing an issue where restricted post queries would fail to render list tables in wp-admin entirely.<\/li>\n<\/ul>\n\n<h4>1.0.8<\/h4>\n\n<ul>\n<li>Security: Solved the Traverse Access Data Leak on frontend searches\/archives. Split the transient cache to strictly enforce Zero-Trust on frontend queries, while exclusively allowing structural parent metadata (Traverse Access) within the wp-admin list table (<code>is_admin()<\/code>) to prevent hierarchy fragmentation.<\/li>\n<\/ul>\n\n<h4>1.0.7<\/h4>\n\n<ul>\n<li>Bugfix: Fixed Gutenberg Block Editor throwing a false-positive \"403 Forbidden: Content restricted\" error during post publication. Authors now securely bypass path-based ACLs when accessing or editing their own content via REST API and frontend template redirects.<\/li>\n<\/ul>\n\n<h4>1.0.6<\/h4>\n\n<ul>\n<li>Feature: Restored Traverse Access logic for hierarchical post types. Allowed child pages will now automatically render their structural parents (Read-Only metadata) across the frontend and admin to prevent WordPress list table fragmentation. Actual parent content remains strictly protected by 403 ACL.<\/li>\n<\/ul>\n\n<h4>1.0.5<\/h4>\n\n<ul>\n<li>Security: Implemented \"Ghost Folders\" for the admin page list. Restricted parent pages are now dynamically masked as \"\ud83d\udd12 Restricted Folder\" exclusively inside wp-admin to maintain site hierarchy without leaking real metadata to unprivileged users.<\/li>\n<li>Bugfix: Implemented object cloning in the get_pages filter to prevent global cache mutation and database hierarchy corruption.<\/li>\n<\/ul>\n\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>Security: Removed Traverse Access bypass from pre_get_posts to strictly enforce Zero-Trust Data Leak Protection on metadata (titles\/excerpts) for hidden parent pages.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Feature: Added Traverse Access (re-parenting) for nested Pages and Menus. Structural parent items are now visible (Read-Only) to preserve site hierarchy.<\/li>\n<li>Feature: Refactored Settings UI into a modern, responsive, block-based card layout.<\/li>\n<li>Feature: Replaced field-clearing 'x' with dedicated 'Remove' action buttons and deletion confirmations.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Security: Fixed ACL bypass vulnerability via Accept header parsing.<\/li>\n<li>Feature: Added visual Multitenancy UI for clear Group vs Base Role separation.<\/li>\n<li>Feature: Enhanced AD bind to support both sAMAccountName and userPrincipalName.<\/li>\n<li>Performance: Replaced slow the_posts loop with optimized pre_get_posts transient cache (fixes N+1 issue).<\/li>\n<li>Bugfix: Resolved capability retention issue when downgrading base roles.<\/li>\n<li>Compatibility: Tested and fully compatible with WordPress 7.1.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release. Features Multi-Domain authentication, LDAP Clone Guard, StartTLS\/LDAPS support, and Zero-Trust path-based ACL routing.<\/li>\n<\/ul>","raw_excerpt":"Enterprise Active Directory integration featuring multi-domain authentication, Zero-Trust ACL URL routing, and dynamic role mapping.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/347051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=347051"}],"author":[{"embeddable":true,"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sanchshevchuk"}],"wp:attachment":[{"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=347051"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=347051"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=347051"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=347051"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=347051"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/mlt.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=347051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}